Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

MEMORYCODE...XE.exe

windows7-x64

10

MEMORYCODE...XE.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2024, 13:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MEMORYCODESTEALERFROMEXE.exe

  • Size

    1.2MB

  • MD5

    e9484520c0af2af421fc682c1e757c76

  • SHA1

    423650cf9f48cf8cdaaac4ed9b5362eadbd0ce90

  • SHA256

    1e2e67e75639830b4e39698bd9c7679d64393b435ab38fc8f07926f7ba36636b

  • SHA512

    099f04bf9fa854eab58d3ec1121f47b2af326bfb560cd14cfb0ad439e0ab575ded05a164ed4a130e0a19c4d1e521f0fa3b0277114f088c7f607e4d4c1b359fa7

  • SSDEEP

    24576:BwRW7N5+l5c/PNRDtual8WDSBHkiEToNkuPpVQN561xtDNwt:BwE7N565SPNRDYqfDSBLwShPAN5c3DK

Score
10/10
xwormevasionrattrojan

Malware Config

Extracted

Family

xworm

C2

147.185.221.21:27938

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    svchost.exe

  • telegram

    https://api.telegram.org/bot6575053517:AAHfQSqLTvzOajvn1QldlaGUVj-u9hK2upc/sendMessage?chat_id=7492036336

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MEMORYCODESTEALERFROMEXE.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMORYCODESTEALERFROMEXE.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Users\Admin\MEMORY CODE STEALER FROM EXE.exe
      "C:\Users\Admin\MEMORY CODE STEALER FROM EXE.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Maps connected drives based on registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2220
    • C:\Users\Admin\svchost.exe
      "C:\Users\Admin\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\svchost.exe
    Filesize

    77KB

    MD5

    7a663541653efa34e7e2aabf0acf6ada

    SHA1

    ae14101f62220e6435ed3d80e03dbb4e5f29b344

    SHA256

    829016d508f4064cc618eef8c9250ad000b15355ce563f172e6e54f776c74f9c

    SHA512

    7267f6b0c41dff35a761171a30ebdfde83e81a29f4511fe808cb28b0d7d0a2a2b101fac57aefe74b9c8475ae37c87471b8dcedf1e9458da5dd8d839270a20508

    Download Submit

  • \Users\Admin\MEMORY CODE STEALER FROM EXE.exe
    Filesize

    1.1MB

    MD5

    d071e8ffbd98a93dde7435f787416897

    SHA1

    1ba077c30bfd6622afb06bd1f864cd61caf5059c

    SHA256

    e3c292de83fccffbe2ad53286410b7ee1eea3a73caae9d97f28b582089ad7a86

    SHA512

    6764f358a817c25309a346581a58374e9f96f44b507e96903010f755b73df923b754386b3edcf1aaf229d1c7432459b51dfb89d33fb591be6f7231b51aad8f05

    Download Submit

  • memory/2056-0-0x000007FEF5283000-0x000007FEF5284000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2056-1-0x0000000000AA0000-0x0000000000BE0000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2220-14-0x00000000001B0000-0x00000000002DA000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2220-15-0x000000001ADF0000-0x000000001AEC6000-memory.dmp

    Filesize

    856KB

    Download

  • memory/2220-16-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2220-17-0x000000001EC20000-0x000000001EE34000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2220-18-0x0000000000A90000-0x0000000000AA2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/2220-19-0x0000000002240000-0x000000000225A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2220-21-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2388-13-0x00000000009D0000-0x00000000009EA000-memory.dmp

    Filesize

    104KB

    Download